Splunk Enterprise Certified Admin SPLK-1003 Book

Data integrity controls in Splunk ensure that indexed data has not been tampered with.

When enabled, Splunk calculates hashes for each bucket and stores these hash files in the rawdata directory of the corresponding bucket.

Incorrect Options:

A, C, D:These directories do not store hash files.

The deployer is a Splunk Enterprise instance that you use to distribute apps and certain other configuration updates to search head cluster members. The set of updates that the deployer distributes is called the configuration

First line says it all: " The deployment server distributes deployment apps to clients. "

" You can specify a SEDCMD configuration in props.conf to address data that contains characters that the third-party server cannot process. "

REGEX = < regular expression >

* Enter a regular expression to operate on your data.

FORMAT = < string >

* NOTE: This option is valid for both index-time and search-time field extraction. Index-time field extraction configuration require the FORMAT settings. The FORMAT settings is optional for search-time field extraction configurations.

* This setting specifies the format of the event, including any field names or values you want to add.

DEST_KEY = < key >

* NOTE: This setting is only valid for index-time field extractions.

* Specifies where SPLUNK software stores the expanded FORMAT results in accordance with the REGEX match.